Hardware-logic based flow collector for distributed denial of service (DDOS) attack mitigation

Abstract

Methods and systems for an integrated solution to flow collection for determination of rate-based DoS attacks targeting ISP infrastructure are provided. According to one embodiment, a method of mitigating DDoS attacks is provided. Information regarding at least one destination within a network for which a distributed denial of service (DDoS) attack status is to be monitored is received by a DDoS attack detection module coupled with a flow controller via a bus. The DDoS attack status is determined for the at least one destination based on the information regarding the at least one destination. When a DDoS attack is detected the flow controller is notified of the DDoS attack status for the at least one destination by the DDoS attack detection module. Responsive thereto, the flow controller directs a route reflector to divert traffic destined for the at least one destination to a DDoS attack mitigation appliance within the network.

Description

CROSS-REFERENCE TO RELATED PATENTS[0001]This application is a continuation of U.S. patent application Ser. No. 14 / 488,697, filed on Sep. 17, 2014, which is hereby incorporated by reference in its entirety for all purposes.[0002]This application may relate to the subject matter of U.S. Pat. No. 7,426,634 entitled, “Method and apparatus for rate based denial of service attack detection and prevention”, U.S. Pat. No. 7,602,731 entitled “System and method for integrated header, state, rate and content anomaly prevention with policy enforcement”, and U.S. Pat. No. 7,626,940 entitled “System and method for integrated header, state, rate and content anomaly prevention for domain name service” all of which are hereby incorporated by reference in their entirety for all purposes.COPYRIGHT NOTICE[0003]Contained herein is material that is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction of the patent disclosure by any person as it appears in th...

AI Technical Summary

Benefits of technology

This patent describes a solution to detect and prevent denial of service (DDoS) attacks on internet infrastructure. The system receives information about where in the network the attack is originating and uses a flow controller to divert traffic away from the affected destination. This reduces the impact of the DDoS attack and helps to keep the network running smoothly.

Problems solved by technology

As more such attacks are launched, the Internet Service Provider (ISP) network infrastructure bears the brunt of such attacks.

A surge in these packets overloads ISP equipment and causes them to slow down, which in turn slows down the service provided by the ISP.

As one skilled in the art knows, software appliances have performance limits.

Images